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Chapter 1—Overview of Federal Alcohol and 
Other Drug Confidentiality Law and 
Regulations 



The regulations that protect the identities of persons in alcohol or drug abuse treatment have their 
genesis in two statutes of the early 1970's: the Comprehensive Alcohol Abuse and Alcoholism 
Prevention, Treatment and Rehabilitation Act of 1970 and the Drug Abuse Prevention, 

Treatment and Rehabilitation Act of 1972. These statutes were implemented by regulations 
issued by the then Department of Health, Education and Welfare (HEW) in 1975. Revised in 
1987 by one of HEW's successors, the Department of Health and Human Services, the 
regulations are set out at title 42, part 2, of the Code of Federal Regulations. Recently, Congress 
reaffirmed and reorganized the original confidentiality statutes by merging them into one act, the 
Public Health Service Act, now title 42, section 290dd-3, of the United States Code. The merger 
had no effect on the confidentiality regulations. Throughout this document, references to the 
confidentiality law or regulations will mean the regulations at title 42, part 2, of the Code of 
Federal Regulations. 

Purpose of the Law 

The Federal drug and alcohol confidentiality laws are predicated on the public health view that 
people with substance abuse problems are likelier to seek (and succeed at) treatment if they are 
assured that their need for treatment will not be disclosed unnecessarily to others. The 
congressional committee that put the original drug confidentiality statute into final form noted in 
its report: "The conferees wish to stress their conviction that the strictest adherence to . . . 
[confidentiality] is absolutely essential to the success of all drug abuse prevention programs. 
Every patient and former patient must be assured that his right to privacy will be protected. 
Without that assurance, fear of public disclosure of drug abuse or of records that will attach for 
life will discourage thousands from seeking the treatment they must have if this tragic national 
problem is to be overcome." 1 In keeping with this view, the drug and alcohol confidentiality 
regulations restrict both the disclosure and the use of information about individuals in federally 
assisted drug or alcohol abuse treatment programs." 

Scope of the Law 

The Federal alcohol and drug confidentiality regulations restrict the disclosure and use of 
"patient identifying" information about individuals in substance abuse treatment. Patient- 
identifying information is information that reveals that a person is receiving, has received, or has 
applied for substance abuse treatment. 3 What the regulations protect is not the individual's 
identity per se, but rather his or her identity as a participant in or applicant for substance abuse 
treatment. 

To Whom Does the Law Apply? 

The regulations apply to holders, recipients, and seekers of patient-identifying information. An 
individual or program in possession of such information—for example, a federally assisted 
substance abuse program—may not release it except as authorized by the patient concerned or as 
otherwise permitted by the regulations. Anyone who receives such information from a substance 
abuse program may not redisclose it without patient consent or as otherwise authorized by the 
regulations and may not use it except for certain purposes discussed below under "Exceptions to 


the Rule for Holders of Patient-Identifying Information." Finally, anyone seeking such 
information may not compel its disclosure except as permitted by the regulations 4 

The Strictness of the Federal Regulations 

The Federal drug and alcohol confidentiality regulations are stricter than most other 
confidentiality rules. In general, they apply whether the person seeking the infonnation already 
has it, is seeking it for a judicial or administrative proceeding, is a law enforcement or other 
government official, 5 has a subpoena or a search warrant, or is the spouse, parent, relative, 
employer, or friend of the patient. 

What Are the Consequences of Violating or Disregarding the Law? 

Violators of the regulations are subject to a criminal penalty in the form of a fine of up to $500 
for the first offense and up to $5,000 for each subsequent offense. 6 Violators that are licensed or 
State certified (which would include virtually all programs and their professional employees) 
jeopardize their license or certification. The patients concerned may also sue violators for 
unauthorized disclosure. 7 

Conflicts With State Laws 

State confidentiality law may be more restrictive than but may not override the Federal 
regulations. Where State law is not stricter and conflicts with the Federal regulations, State law 
must yield. Even where State law conflicts with the regulations, however, the State law can 
usually be complied with through one of the many exceptions to the regulations. 

General Rule for Holders of Patient-Identifying Information 

The general rule is that a federally assisted drug or alcohol abuse program may not disclose, 
directly or indirectly, the identity of its former, current, or would-be patients. However, the rule 
is not absolute, and most requests for patient-identifying information can be accommodated by 
one or another exception to the rule. This section explores the elements of the rule. 

What Is a Program? 

The regulations apply to federally assisted organizations and individual practitioners (for 
example, psychologists, physicians, or even acupuncturists) that specialize in providing, in whole 
or in part, individualized (that is, one-to-one) 8 alcohol or drug abuse diagnosis, treatment, or 
referral for treatment. 9 The regulations apply to both freestanding programs and programs that 
are part of larger organizations, for example, a detoxification unit in a general hospital or a 
substance abuse clinic in a county mental health department. Part- and full-time employees, 
volunteers, student interns, former staff, and executive, administrative, clinical, and support 
personnel must comply with the regulations. 


What Does It Mean To Be Federally Assisted? 


A program is federally assisted if it is directly funded by the Federal Government, is operated by 
the Federal Government, is certified for medicaid reimbursement, receives Federal block grant 
funds through a State or local government, is licensed by the Federal Government (for example, 
to dispense methadone), or is exempt from paying taxes under a provision of the Federal Internal 
Revenue Code. 

What Is a Disclosure of Patient-Identifying Information? 

A disclosure of patient-identifying information is any communication that directly or indirectly 
identifies someone as being in, having been in, or having applied for treatment in a substance 
abuse program. A program will have made a patient-identifying disclosure where it discloses a 
patient's record, permits an employee to testily about a patient's treatment, allows a receptionist 
to confirm that a particular person is a patient of the program, uses stationery that suggests that 
the addressee may be one of its patients, or discloses anecdotal material from which a patient's 
identity may be inferred. 

Who Is a Patient? 

A patient is anyone who has applied for or received a diagnostic examination or interview, 
treatment, or referral for treatment for drug or alcohol abuse from a drug or alcohol program. 
Applicants for such services are covered by the regulations even if they fail to show for their 
initial appointment or evaluation or, having been interviewed or diagnosed, elect not to follow up 
or enter treatment. The regulations protect current, former, and deceased patients. 

Exceptions to the Rule for Holders of Patient-Identifying Information 

The Federal confidentiality regulations are strict, but not absolute. They allow patient-identifying 
disclosures in several situations. 

Internal Program Communications 

Patient-identifying information may be disclosed within a program, or to an entity having direct 
administrative control over a program, if the recipient of the disclosure needs the information to 
provide substance abuse services to the patient. "Within the program" means within the 
organization or organizational unit that provides substance abuse services. This means, for 
example, that the staff of a detoxification unit within a hospital may share patient-identifying 
information with one another—and with hospital administrators with direct supervisory oversight 
for the program—where such sharing of information is needed to provide substance abuse 
services to the program's patients. The program may also share information, where necessary, 
with, for example, the hospital's recordkeeping or billing departments, since those units are 
integral to the program's functioning. However, the program may not freely share patient- 
identifying information with other parts or units of the hospital. Anyone within or in direct 
administrative control of a program who receives patient-identifying information is bound by the 
confidentiality regulations and may not redisclose the infonnation except as allowed by the 
regulations. 


Consent 


Generally, a program may disclose any information about a patient if the patient authorizes it by 
signing a valid consent form. 10 To be valid, a consent must specify the following: 

• The name of the patient 

• The name of the program making the disclosure 

• The purpose of the disclosure 

• Who is to receive the information 

• The information to be released (described as exactly and as narrowly as possible in light of the 
purpose of the release) 

• That the patient understands that he or she may revoke the consent at any time, except to the 
extent that action has been taken in reliance on it 11 

• That revocation may be oral as well as written 

• The date or condition upon which the consent expires, if it has not been revoked earlier 

• The date the consent form is signed 

• The signature of the patient 12 

A proper consent—that is, a consent that includes the foregoing features—will pennit a holder of 
patient-identifying information to make patient-identifying disclosures to outsiders, such as 
probation officers, employers, or relatives of the patient. When making a disclosure pursuant to 
such a consent, a program need not send a copy of the consent to the recipient of the disclosed 
material. Where, however, the program is asked for a disclosure by someone outside the 
program, it will have to receive a copy of the consent before it may respond to the request. The 
regulations permit a program to make a patient-identifying disclosure pursuant to a copy (as 

13 

opposed to the original) of a consent. 

Whenever a disclosure is made pursuant to a consent, it must be accompanied by a written notice 
prohibiting redisclosure. 14 The notice prohibiting redisclosure warns the recipient that the 
information disclosed is protected by Federal law and may not be redisclosed except with the 
patient's consent or under an exception to the regulations. The prohibition-on-redisclosure notice 
must be sent to the recipient even where the disclosure was made orally. 

Anonymous or Non-Patient-Identifying Information 

That programs may not disclose patient-identifying information does not mean that they may not 
disclose a patient's identity. (Patient-identifying information is infonnation that reveals that the 
patient is in, has been in, or has applied for substance abuse treatment.) What programs are 
prohibited from disclosing—except where authorized by the patient or the regulations—is a 
patient's participation in treatment. Thus, a disclosure may reveal a patient's name, address, or 
even telephone number without violating the regulations. 15 What a given disclosure may not 
reveal is the nature of the services received by the patient or provided by the program. 16 

Qualified Service Organization Agreement 



Programs may disclose information to a "qualified service organization" without the patient's 
consent. 17 A "service organization" is a person or agency that provides services—such as data 
processing, dosage preparation, laboratory analyses, vocational counseling, or legal, medical, 
accounting, or other professional services—to a program that the program does not provide for 
itself. As the provision of such services may entail patient-identifying disclosures, the outside 
agency must be "qualified" to communicate freely with the treatment program. To become 
qualified, the service organization must enter a written agreement with the program in which it 
acknowledges that it is bound by the Federal confidentiality regulations, promises not to 
redisclose patient-identifying information to which it becomes privy, and promises to resist 
unauthorized efforts to gain access to any patient-identifying infonnation that may come into its 
possession. 18 

Once the program and the outside agency have entered an agreement of this kind, the program 
may freely communicate infonnation from patient records to the qualified service organization, 
but only that information needed by the organization to provide services to the program. 

Although programs may enter into qualified service organization agreements with a variety of 
outside organizations, they are not pennitted—according to a legal opinion of the Department of 
Health and Human Services, which revised the regulations in 1987—to enter them with one 
another (unless the one offers a service that the other cannot provide) or with law enforcement 
agencies. A program need not inform its patients of the qualified service organization agreements 
to which it is a party. 

Crimes on Program Premises or Against Program Personnel 

The regulations permit a program to release patient-identifying information to the police where a 
patient commits or threatens to commit a crime on the premises or against program staff. Under 
these circumstances, the program may give the police the patient's name, address, and last known 
whereabouts. The exception does not pennit the program to report a patient's other crimes. 

Medical Emergencies 

Even without consent, patient-identifying infonnation may be disclosed to certain persons in a 
medical emergency. 19 A medical emergency is a situation that poses an immediate threat to the 
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health of an individual (it need not be the patient) and requires immediate medical intervention." 
Under this exception, a program may release patient-identifying information to medical 
personnel who need the information to treat the medical condition. The medical-emergency 
exception may not be invoked to disclose patient-identifying information to the patient's family 
or other nonmedical personnel. 

Mandated Reports of Child Abuse or Neglect 

All States require people in certain positions or occupations to report cases of suspected child 
abuse or neglect to the relevant child welfare authorities. In 1986, the Federal regulations were 
amended to permit substance abuse programs to comply with such laws. Today, the Federal 
regulations "do not apply to the reporting under State law of incidents of suspected child abuse 
and neglect to the appropriate State or local authorities." This means that program staff may 



make reports to local child abuse hotlines and even confirm the reports in writing. However, the 
regulations "continue to apply to the original alcohol or drug abuse patient records maintained by 
the program including their disclosure and use for civil or criminal proceedings which may arise 
out of the report of suspected child abuse and neglect." This means that while a program may 
make State-mandated child abuse reports, it must still protect patient records from subsequent 
disclosures (even as against local child welfare investigators) and, absent patient consent or a 
court order, may not pennit them to be used in child abuse proceedings against the patient. 

Research 

Under certain circumstances, a program may allow a researcher to have access to its patients' 
records. In the event, the program director must determine that the researcher is qualified, that 
the researcher has a protocol under which the security of patient records is assured, 23 and that 
patient-identifying information will not be redisclosed. Additionally, three or more independent 
evaluators must have reviewed the research protocol and detennined that the rights and welfare 
of the patients concerned will be adequately protected and that the potential benefits of the 
research outweigh the risks to patient confidentiality. Researchers are barred from redisclosing 
patient-identifying information except back to the program itself. 

Audit and Evaluation 

Certain qualified individuals or organizations may have access to program records for audits or 
evaluations of the program. 24 By definition, an audit or evaluation is a time-limited activity that 
may not be used to gain access to program records on an ongoing basis. Audits or evaluations 
may be conducted by regulatory agencies, funders, private third-party payers, and private peer 
review organizations. Information disclosed during an audit or evaluation may not be 
redisclosed except pursuant to a court order (where a program is being investigated) or to 
determine compliance by the program with medicaid or medicare regulations. If the auditor or 
evaluator wishes to copy or remove records, he or she must agree in writing to protect patient- 
identifying infor-mation, destroy all such information on completion of the audit or evaluation, 
and not use the information except for purposes of the audit or evaluation. 

Court Orders 

A Federal, State, or local court may authorize a program to make a disclosure of confidential 
patient-identifying information. A court may issue such an order, however, only after following 
certain procedures and making certain determinations specified in the regulations. A subpoena, 
search warrant, or arrest warrant, even when it is signed by a judge, is not sufficient, by itself, to 
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require or even permit a program to make a disclosure.“ 

Procedures and Restrictions 

Before a court can issue an order authorizing a disclosure, the program and the patient whose 
records are sought must be given notice of the application for the order and some opportunity to 
make an oral or written statement in response. (However, if the information is being sought to 
investigate or prosecute a patient, the patient is not entitled to notice. 28 Similarly, where the 
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program is being investigated, the program is not entitled to notice." ) The application and any 
court order must use a fictitious name for the patient. All court order proceedings in connection 
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with the application must be confidential unless the patient requests otherwise. 

Before it may order the disclosure of confidential patient infonnation, a court must find that there 
is "good cause" for the disclosure. A court can find good cause only if it detennines that the 
public interest and the need for disclosure outweigh any adverse effect that the disclosure may 
have on the patient, the doctor-patient relationship, or the effectiveness of the program's 
treatment services. If the information is available from another source, the court may not issue 
the order. The judge is entitled to examine the records before making a decision. 

Even where good cause for dis-closure exists, there are limits to the scope of the disclosure that 
the court may authorize. In fact, disclosure must be limited to the information essential to the 
purpose of the order, and the dissemination of the infonnation must be restricted to those persons 
who need it to fulfill the purpose of the order. The court should also take steps to protect the 
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patient's confidentiality, for example, by sealing the records of the proceeding/ 

Where the information sought is a "confidential communication," it may not be disclosed unless 
the disclosure is necessary to protect against a threat to life or of serious bodily injury, is 
necessary to investigate or prosecute an extremely serious crime, or is connected with a 
proceeding in which the patient has already presented evidence concerning the confidential 
communication. 34 In all other situations, not even a court can order disclosure of a confidential 
communication. 

Procedures in Criminal Investigations 

Where an investigative, law enforcement, or prosecutorial agency seeks an order authorizing a 
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disclosure for the purpose of investigating or prosecuting a patient, it must demonstrate the 
following: 

• The crime involved is extremely serious, that is, one that causes or threatens to cause death or 
serious injury 36 

• The records sought are likely to contain information of significance to the investigation or 
prosecution 

• There is no other practical way to obtain the information 

• The public interest in disclosure outweighs any actual or potential harm to the patient, the 
doctor-patient relationship, or the ability of the program to provide services to other patients 

• The program has had an opportunity to be represented by independent counsel 

• (When the program is a governmental entity, it must be represented by counsel .) 37 

Where the order is sought to prosecute a patient, the court must follow the same 
procedures that apply to court-ordered disclosures generally (except that the patient need 
not be given notice). In addition, a court order authorizing a disclosure for the purpose of 
investigating or prosecuting a patient must limit the disclosure to those parts of the 
patient's record that are essential to the purpose of the order. Further, only those law 
enforcement and prosecutorial officials responsible for conducting the investigation or 



prosecution may have access to the information. As with other applications, the court 
may not order the disclosure of "confidential communications" except in narrowly 
defined circumstances (see "Procedures and Restrictions" above). Under no 
circumstances may a court authorize a program to turn over a patient's entire record to a 
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law enforcement, investigative, or prose-cutorial agency. 

Restrictions on Redisclosure 

That patient-identifying information may be disclosed pursuant to one of the many exceptions to 
the general rule does not mean that the disclosed information is no longer protected. Indeed, as 
noted above, information released pursuant to a consent must be accompanied by a written notice 
informing the recipient that the information he or she has received is protected by Federal law 
and may not be redisclosed except as provided for in the regulations. No one who receives 
patient-identifying information under the regulations—including third-party payers, government 
employees, program staff, administrators, criminal investigators and law enforcement personnel, 
court personnel, researchers, auditors, evaluators, and employees of qualified service 
organizations—may redisclose it unless authorized to do so by the patient, a court order, or 
another exception to the regulations. 

Restrictions on Use 

Except pursuant to a court order, information subject to the regulations may not be used to 
initiate, investigate, or substantiate criminal charges against a patient. In addition, patient- 
identifying information obtained in violation of the regulations can be excluded from evidence in 
both civil and criminal proceedings. 


Footnotes 

1H.R. Rep. No. 92_920, 92d Cong., 2d Sess., p. 33 (in U.S. Code Cong. & Admin. News, 1972, 
p. 2072). 

2 42 CFR § 2.3(a). 

3 42 CFR §2.11. 

442 CFR § 2.13(b). 

5 42 CFR §§ 2.13(b), 2.20. This includes public health officials. However, holders of patient- 
identifying information can invoke exceptions to the regulations to comply with their public 
health obligations, such as the reporting of cases of tuberculosis as mandated by State law. 

6 42 CFR § 2.4. Violations may be reported to the local U.S. attorney. Violations by methadone 
programs may be reported to the regional offices of the Food and Drug Administration (42 CFR 
§ 2.5). 



7 Evidence used or obtained in violation of the regulations may be excluded in both civil and 
criminal cases. See United States v. Eide, 875 F. 2d 1429 (9th Cir. 1989) (excluding illegally 
seized records in criminal prosecution), and Jeanette "A" v. Condon, 728 F. Supp. 204 (S.D.N.Y. 
1990) (prohibiting an employer from terminating an employee on the basis of an improperly 
disclosed urinalysis result). 

8 

Programs that provide generalized services are not covered by the regulations. Thus, a 
classroom education program aimed at all the students in a class or a grade is not covered. 
However, should an employee of such a program engage a student in one-to-one or even group 
counseling, the program would become subject to the regulations. 

9 The regulations apply whether a program provides all three or just one of the following services 
for drug or alcohol abuse: diagnosis, treatment, or referral for treatment. 

1042 CFR §§ 2.31, 2.33. It should be noted that consents authorize but do not compel programs 
to make a disclosure. 

1 depending on State law, a consent for a patient referred by the criminal justice system may be 
made irrevocable for a period of time (42 CFR § 2.35). Some States have statutes that provide 
for the automatic expiration of such consents after 60 or 90 days. 

12 

If the patient has died, the executor or administrator of the estate or, if there is none, the spouse 
or closest other relative of the deceased patient may sign (42 CFR § 2.15(b)(2)). If the patient 
dies while in the program, no consent is needed to disclose infonnation relating to the cause of 
death to such agencies as are empowered to collect vital statistics or inquire into causes of death 
(42 CFR § 2.15(b)(1)). If the patient is incompetent, a person appointed by a court to oversee his 
or her affairs may sign (42 CFR § 2.15(a)). If the patient is a minor, the patient must still always 
sign the consent form. If State law requires parental consent for treating a minor, a parent's 
signature will be required, in addition to the minor’s, for any release (42CFR § 2.14(c)). If the 
State permits the minor to be treated without parental consent, the minor's signature alone may 
authorize a disclosure (42CFR § 2.14(b)). 
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Disclosures to a central methadone registry must be made with patient consent (42 CFR § 

2.34). A central registry collects information about patients applying for methadone maintenance 
or detoxification. (The registry is intended to prevent dual enrollments.) A program may disclose 
records to any central registry not more than 200 miles away. Such disclosures may be made 
only when a patient is accepted for treatment, changes type or dosage of drug, or ends, interrupts, 
or resumes treatment. Patient consent is required in writing, but programs may refuse to enroll 
patients who will not consent. Disclosed information must be limited to the patient's name and 
identifying information, dosage of drug, and relevant dates. The registry may disclose to its 
member programs the names, addresses, and telephone numbers of any other programs in which 
the patient is enrolled. Those programs may then communicate with one another without patient 
consent, but only to the extent necessary to verily that no error has been made or to prevent or 
eliminate any multiple enrollment. 

14 42 CFR § 2.32. 



l5 Thus, if a patient threatened to hann his or her spouse, the program might make an anonymous 
telephone call to the spouse or even the police. To be effective, of course, such a call would 
require the program to disclose the patient's name. It would not, however, require the program to 
disclose its name or the fact that the patient is in substance abuse treatment. 

16 Where a program is part of a larger organization, such as a general hospital, and is required to 
make reports of communicable diseases, such as tuberculosis or human immunodeficiency virus, 
it can discharge its reporting obligation by using the larger organization's name and address. 
Thus, the detoxification unit of a general hospital would make the necessary report under the 
name of the hospital. It should be noted that some courts have found a duty to warn where there 
is an identifiable victim. In such cases, a program may very well have to notify both the relevant 
authorities and the potential victim, and, in the process, may even have to disclose patient- 
identifying information. 

17 42 CFR§ 2.12(c)(4). 

18 42 CFR § 2.11. 

19 42 CFR §2.51. 
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‘ A typical example of a medical emergency is a suicide threat or a drug overdose. 

21 42 CFR § 2.12(c)(6). 

22 42 CFR § 2.52. 

23 42 CFR § 2.16. 

24 42 CFR § 2.53. 

25 

"Accounting audits do not usually fall under the audit-and-evaluation exception to the 
regulations. These are usually conducted pursuant to a qualified service organization agreement. 

26 42 CFR §§ 2.63-2.67. 

27 42 CFR §2.61. 

28 42 CFR §2.65. 

29 42 CFR § 2.66. 

30 42 CFR §§ 2.64-2.66. 

31 42 CFR § 2.64(d). 

32 42 CFR § 2.64(c). 



33 42 CFR § 2.64(e). 

34 42 CFR § 2.63. 

35 42 CFR § 2.65. 

42 CFR § 2.63 sets forth a list of serious crimes for which a court may order disclosure of 
patient records. The list does not include the possession or sale of illegal drugs. 
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Note that the regulations do not permit courts to order those "who have received patient 
identifying information without consent for the purpose of conducting research, audit or 
evaluation, to disclose that information or use it to conduct any criminal investigation or 
prosecution of a patient." 42 CFR § 2.62. 
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The regulations also contain special provisions regarding court orders authorizing disclosures 
for purposes of investigating or prosecuting a program or its employees and court orders 
authorizing a government agency to place an undercover agent or informant in a program to 
gather evidence of serious criminal conduct by the program or its employees (42 CFR §§ 2.66- 
2.67). The regulations set strict prerequisites for obtaining such orders and prohibit the use of 
information obtained through these means to initiate or substantiate criminal prosecutions against 
patients. 
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Chapter 2—Confidentiality of Alcohol and 
Other Drug Treatment Records and 
Communicable Disease: Options for 
Successful Communication and 
Collaboration 


In an effort to prevent, treat, and control the spread of communicable diseases, all States require 
health care providers and sometimes others to report cases of communicable disease to local 
public health authorities. These reports enable public health officials to locate, examine, counsel, 
treat, and monitor anyone presenting with a communicable disease. These mandated reporting 
requirements may appear to conflict with the Federal confidentiality regulations for drug and 
alcohol records, which, as discussed in Chapter 1, restrict patient-identifying disclosures about 
individuals in alcohol or drug treatment. Yet the Federal confidentiality regulations contain 
exceptions that allow substance abuse programs to discharge their State-mandated 
responsibilities with respect to the reporting of communicable diseases. In fact, the exceptions to 
the regulations not only permit programs to make the necessary communicable disease reports 
but also make it possible for them to cooperate on an ongoing basis with public health officials 
(and other health care providers) in efforts to treat and monitor those alcohol and other drug 
(AOD) patients who present with communicable disease. 

Public Health Activities With Respect to Communicable Disease 

For AOD programs to decide which exception or exceptions should be invoked (or are most apt) 
for purposes of meeting their State-mandated disease reporting and followup responsibilities, 
they need to understand what it is that public health officials (and other health care providers) 
may want or need to do in response to a communicable disease case report. At the least, public 
health officials want or need to— 

• Identify an actual or suspected case of communicable disease 

• Verify the case by examination 

• Counsel the infected patient with an eye toward preventing further transmission 

• Prescribe appropriate treatment 

• Locate contacts or trace partners for purposes of identifying other cases and preventing further 
transmission 

• Monitor treatment for efficacy and compliance 

• Identify the nonadherent or noncooperative patient for purposes of invoking either civil or 
criminal sanctions 



An appreciation of these activities will enable programs to ascertain exactly what information is 
needed for which public health purpose or activity and which of the available exceptions to the 
confidentiality regulations best fits the situation. 1 

How Programs Can Comply With Communicable Disease Reporting 
Requirements 

Reporting With Patient Consent 

The easiest way for an AOD program to comply with State-mandated communicable disease 
reporting and followup requirements is for the program to secure the patient's consent to both the 
mandated report and followup activities. Such a consent can be put in place at intake or 
screening, with periodic renewals as necessary. Depending on State law, the consent can be 
made to last for as long as the patient is in the program." 

Given a proper consent, a program may report nearly anything the patient authorizes it to report, 
including the patient's state of health and whereabouts. The ability to report the patient's 
whereabouts (something that is almost always problematic for patients in residential treatment, 
since, by definition, a disclosure of a residential treatment patient's address is patient identifying) 
is especially important in the case of patients who must be examined without delay, for example, 
pa-tients with suspected tuberculosis (TB). Easy location of the patient also facilitates followup 
activities, including counseling and education, interviewing for the purpose of identifying 
contacts and partners, treatment, and monitoring for compliance. 

Moreover, a consent, unlike some other exceptions, can allow for the redisclosure of patient- 
identifying information. This is particularly important where different public health officials 
need to communicate with one another or other health care providers for purposes of tracking 
and controlling disease. Indeed, the only drawbacks to the consent option, at least from the point 
of view of public health (and leaving aside the question of having to explain a consent to a 
patient, which some programs find troublesome, depending on the populations they serve), are 
that a consent may be withdrawn at will by the patient and that a consent may not be the basis for 
imposing criminal sanctions on a noncompliant patient or a patient who engages in risky 
behavior. Only a court order may authorize the imposition of such sanctions against a 
noncompliant or risk-taking patient. 

Reporting "Anonymously" 

A program could conceivably discharge its State-mandated disease reporting obligations by 
making anonymous or non-patient-identifying disclosures. Under this exception, a program is 
allowed, for example, to disclose a patient's name and state of health and even his or her 
whereabouts as long as in doing so it does not also disclose that the patient is in substance abuse 
treatment. Notwithstanding its apparent attractions, there are problems with a program's electing 
to rely on this exception to discharge its disease reporting or followup obligations. The most 
obvious of these has to do with the fact that most States require reporters to identify themselves. 
Obviously, a freestanding or residential treatment program would not be able to comply with an 
identification requirement without giving itself and the patient away. (A program that is part of a 


larger organization, such as a hospital, can simply report under the larger organization's name, 
assuming, of course, that the larger organization is not itself an identifiable substance abuse 
treatment provider.) A second problem arises where the recipient of the disclosure—here, a 
public health agency—wishes to establish ongoing communication with the program for the 
purpose of identifying and locating individuals who may have come in contact with, say, an 
AOD patient who is suspected of having TB. Under the circumstances, a program would not be 
able to cooperate with public health officials in locating, examining, counseling, educating, 
treating, or monitoring such contacts, since, in all likelihood, such cooperation would result in 
impermissible disclosures. 

Reporting by Use of a Qualified Service Organization Agreement 

Programs required to make communicable disease case reports to local public health officials 
may comply with their reporting obligations—and put in place a mechanism authorizing ongoing 
communications between the program and an outside agency involved in treating or monitoring a 
patient's care—by entering a qualified service organization agreement (QSOA) with an outside 
agency or individual (the qualified service organization). 

Thus, a treatment program can enter a QSOA with an outside medical care provider who would 
agree to provide screening and treatment to the program's patients and make mandated 
communicable disease reports to the State or local public health authorities. Such an arrangement 
would enable the AOD program and the outside service organization to share information 
(including AOD-patient-identifying information) without first obtaining individual patient 
consents. 4 However, in making mandated reports to public health officials, the outside service 
provider would be forbidden from disclosing any AOD-patient-identifying information, unless 
the redisclosure was authorized by consent or by one of the other exceptions under the 
regulations. Such a QSOA arrangement would pennit the program to discharge its State- 
mandated communicable disease case reporting obligations. However, depending on the nature 
of the qualified service organization, this arrangement probably would not permit the program to 
cooperate with local public health officials in following up on a given communicable disease 
report. 

The program could overcome this problem by entering a QSOA directly with the State or local 
public health officials responsible for conducting communicable disease prevention, treatment, 
and control activities.A QSOA between an AOD program and a public health agency would 
open a channel of communication between the two that would permit the fonner to make 
mandated reports and allow the latter to follow up any such reports to the degree necessary. 

Because qualified service organizations may not redisclose AOD-patient-identifying information 
except with the patient's consent or as otherwise authorized by the AOD confidentiality rules, a 
question arises as to whether a program can meet all its State-mandated communicable disease 
reporting obligations through a QSOA where those obligations require the redisclosure of 
patient-identifying information throughout the public health bureaucracy involved in controlling 
communicable disease. In some States, the State and local public health units are separate 
governmental entities. In those States, an AOD program could enter a QSOA with each of the 
units (assuming that each agreed to provide services to the program) and could communicate 



AOD-patient-identifying information back and forth with each public health unit. However, the 
State and local units could not share such information with each other—unless the patient 
consented or another exception to the Federal rules authorized such disclosures. This is because 
the QSOA between the AOD program and each of the public health units could not authorize 
either of the latter to redisclose AOD-patient-identifying infonnation to any other entity, 
including other public health units. And since QSOA's may only be entered into between an 
AOD program and an outside service organization, the respective State and local health 
departments or units—neither of which would qualify as an AOD program—could not enter a 
QSOA with each other. 

Thus, if the local public health agency and the State public health agency are separate entities, a 
QSOA with the local public health authorities will not permit the local public health agency to 
redisclose AOD-patient-identifying information to the State public health agency. In that event— 
for example, where the qualified service organization is a private physician or other agency—the 
local public health office has three options: (1) delete patient-identifying information from its 
reports to the State, (2) get patient consent to the disclosure, or (3)contact the patient for 
followup and rely on the patient's self-disclosing that he or she is in substance abuse treatment. 
(The regulations do not prevent patients from disclosing their own treatment status. Self¬ 
disclosures are not protected information and may be redisclosed without violating the 
regulations.) 

However, where the qualified service organization is the local public health unit and the local 
public health unit is part of the same governmental entity as the State public health agency—that 
is, where the local public health unit is a subdivision of the State public health agency—a single 
QSOA can solve this problem. In such cases, the QSOA can specify that the qualified service 
organization that is to provide services to the program consists of both the local and State public 
health agencies. 

Reporting and Followup Under the Research Exception 

Under the research exception to the regulations, a program may permit a researcher to gather 
data for research purposes. Presumably, the exception would allow the program to give public 
health agencies access to patient records for purposes of gathering data on the presence of 
communicable disease within the program. The exception might even allow public health 
agencies to engage in examination, counseling, education, contact identification, treatment, and 
monitoring. It would not permit public health agencies to share patient-identifying infonnation 
with other health care providers or patient contacts or partners. Indeed, inasmuch as it is 
predicated on the idea that the researcher is conducting research (as opposed to public health 
followup), requires the researcher to be possessed of a research protocol, and turns on an 
independent panel's evaluation of the benefits of the proposed research, this exception seems to 
be of only limited use for purposes of public health reporting and followup. A broader 
interpretation would distort the language and spirit of the regulations. 


Audit and Evaluation 



The audit-and-evaluation exception is plainly intended to pennit regulatory agencies, funders, 
third-party payers, and peer review organizations to keep an eye on AOD programs to make sure 
that such programs are doing what they are supposed to be doing: providing effective substance 
abuse treatment. Accordingly, information disclosed during an audit or evaluation may not be 
used except for purposes of the audit or evaluation, and, in any case, may not be redisclosed 
except to medicaid or medicare officials or to law enforcement officials investigating a program 
pursuant to a court order. Under the circumstances, it would be inappropriate to rely on this 
exception for purposes of public health reporting or followup. Nonetheless, according to an 
opinion letter issued by the Department of Health and Human Services, this exception may be 
used for purposes of public health reporting and some followup—namely, patient counseling and 
interviewing—in cases of human immunodeficiency virus and acquired immunodeficiency 
syndrome (HIV/AIDS). 5 The Department has never opined formally as to whether the exception 
may also be used for purposes of reporting and following up sexually transmitted diseases, TB, 
or other communicable diseases. 

Reporting and Followup Under the Medical-Emergency Exception 

Under the medical-emergency exception, a program may make a patient-identifying disclosure to 
medical personnel in a medical emergency that requires immediate medical intervention. Under 
this rather narrow exception (which requires a case-by-case decision as to whether a threat exists 
or immediate medical intervention is required), a program could report a communicable disease 
to public health officials only if the following conditions are met: 

• The presence of an infected or allegedly infected individual in the program could be said to 
constitute a medical emergency 

• Public health officials are medical personnel 

Assuming that public health officials are medical personnel (a safe enough assumption), the real 
question is whether the presence in a treatment program of an individual who is infected with a 
communicable disease can be said to constitute a medical emergency for either the individual or 
others. (Under the regulations, a medical emergency is a situation that requires immediate 
medical intervention.) The answer to the question turns on the nature of the disease itself and 
how it is trans-mitted. Generally, sexually transmitted diseases—such as syphilis and gonorrhea, 
and even hepatitis—are not considered emergencies of the sort that require immediate medical 
intervention; 6 this is also the case with HIV/AIDS. These diseases, though communicable, are 
not emergencies because they do not pose immediate threats to life and because the threat posed 
by HIV/AIDS cannot be prevented or relieved by resort to immediate medical intervention. 
Accordingly, they may not be reported to public health officials under the medical-emergency 
exception to the regulations. 

The situation is different with TB or suspected TB. Because TB is transmitted by casual contact, 
is difficult to confirm, and is potentially deadly, the presence of a suspected case of TB in a 
treatment program may very well constitute the sort of emergency that can be reported to public 
health officials under the medical-emergency exception to the regulations. For the same reasons, 
it may also be that a suspected or confirmed case of TB will permit a program not only to make 



the required report to public health officials but also to cooperate with them in their followup 
activities. 

Court Orders 

A program that is required to report communicable diseases to local public health officials may 
always resort to a court order to make the necessary report. This is true whether the program is 
seeking to report sexually transmitted diseases, HIV/AIDS, or TB. A proper court order may 
authorize a program both to make mandated reports and to cooperate with public health followup 
activities. 

Nonetheless, there are serious drawbacks to the use of a court order in such a situation. In the 
first place, the procedure for obtaining a court order is complicated and time-consuming. Second, 
there is no guarantee that a court will grant the requested order, since the court must find that the 
in formation in question is not otherwise available and that the public interest outweighs the 
private interest at stake. Third, the benefit of a court order might be outweighed by its negative 
impact on client-program relations. (A program that readily resorts to court orders to meet public 
health reporting requirements is probably undermining itself, though this is not to deny the place 
of court orders in certain situations.) 7 

Options for Communicating and Collaborating in the Provision of 
Communicable Disease Treatment, Monitoring, and Followup: 

What Is Possible? 

It is up to each program to decide what is the best or most apt exception for purposes of meeting 
State public health reporting requirements. Perhaps in an ideal world programs and patients 
would both agree to put in place appropriate consents that would allow programs to comply with 
all their public health obligations. Yet consents are not without their drawbacks. The most 
important of these drawbacks is that consents can be withdrawn at will. 

To be sure, a program might counter the revocation of a consent by making treatment contingent 
on a new consent (whether a program can do this depends on State law), but such a move— 
smacking as it does of coercion—would not be without costs and could damage the therapeutic 
relationship. 

Another option would be to put in place a QSOA with the local public health agency. This would 
permit the program to comply with both reporting and followup obligations. Since a program is 
not obligated to inform a client of the existence of a QSOA, this option may also be considered 
to have the added advantage of making the QSOA appear to be something of a fait accompli. 
(This is not to suggest that a program should be casual about its patients' concerns about 
confidentiality; it is actually to suggest something else: that programs are under obligations that 
they may not avoid, that these obligations sometimes involve the rights of their patients, and that 
programs should be open and matter-of-fact about meeting those obligations.) 


Though they have less to recommend them, the other exceptions to the regulations have their 
uses. Thus, a program that cannot persuade a patient to consent to a disclosure and that does not 
have an appropriate QSOA in place may wish to report a communicable disease anonymously. 
(The limits of anonymous reports are discussed in "Reporting ’Anonymously'" above.) Programs 
wishing to report a case of HIV could invoke the unpersuasive but useful route recommended by 
the Department of Health and Human Services, namely, using the audit-and-evaluation exception 
for that purpose. With regard to TB or suspected TB, a program can probably rely on the 
medical-emergency exception to make a report. Finally, a program can always seek to discharge 
its reporting and followup obligations by going to court. 


Footnotes 

'it goes without saying that collaboration and cooperation in this important area redound to 
everyone's benefit. This is particularly true with respect to cases of tuberculosis, which, unlike 
some other communicable diseases, can be spread by casual contact. 

“Some States have laws that limit the validity of releases and consents to no more than 60 or 90 
days. In such States, a consent would have to be renewed at the appropriate juncture. 

Of course, there is nothing to prevent the program from urging those of its staff and clients who 
may have been exposed to a communicable disease to call the appropriate officials or other 
providers for examination and followup. 

4 AOD programs are not required to obtain patient consent prior to entering a QSOA, nor need 
they infonn patients of the QSOA's to which they are a party. Naturally, to the extent that a 
patient (who, after all, proceeds with the assurance that his or her records are confidential) is 
surprised by a given QSOA, his or her confidence in the program or his or her therapist may be 
undermined. It is probably in a program's interest to infonn its patients of existing or proposed 
QSOA’s. 

5 The Legal Action Center disagrees with the Department of Health and Human Services on this 
matter (see letter from Margaret K. Brooks, President/Director, Legal Action Center, to Richard 
Riseberg, Esq., General Counsel, Office of the General Counsel, September 25, 1990, in 
AppendixB). 

6 This is the opinion of the Department of Health and Human Services (see letter from Susan K. 
Zagame, Acting General Counsel, Health and Human Services, to Peter J. Millock, General 
Counsel, Department of Health, State of New York, May 17, 1989, in Appendix B). 

7 Court orders are not a panacea. They do not permit redisclosure and are not readily available for 
the purpose of imposing criminal sanctions on a patient. 



Appendix A of TAP 13: Confidentiality of Patient Records for Alcohol and Other Drug 
Treatment 


Appendix A—Sample Forms 


Sample Form #1 

CONSENT FOR THE RELEASE OF CONFIDENTIAL ALCOHOL OR DRUG TREATMENT INFORMATION 


I, 


(Name of patient) 


, authorize 


(Name or general designation of program making disclosure) 

to disclose to_the 

(Name of person or organization to which disclosure is to be made) 

following information:_ 

(Nature of the information, as limited as possible) 


The purpose of the disclosure authorized herein is to:_ 

(Purpose of disclosure, as specific as possible) 


I understand that my records are protected under the federal regulations governing 
Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and cannot be 
disclosed without my written consent unless otherwise provided for in the regulations. I also 
understand that I may revoke this consent at any time except to the extent that action has been 
taken in reliance on it, and that in any event this consent expires automatically as follows: 












the date, event, or condition upon which this consent expires) 


(Specification of 


Dated: 


Signature of participant 


Signature of parent, guardian or authorized 
representative when required 


Sample Form #2 

PROHIBITION ON REDISCLOSURE 
OF INFORMATION CONCERNING CLIENT 
IN ALCOHOL OR DRUG ABUSE TREATMENT 


This notice accompanies a disclosure of information concerning a client in alcohol/drug abuse 
treatment, made to you with the consent of such client. This information has been disclosed to you from 
records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from 
making any further disclosure of this information unless further disclosure is expressly permitted by the 
written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general 
authorization for the release of medical or other information is NOT sufficient for this purpose. The 
Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or 
drug abuse patient. 










Sample Form #3 


CONSENT FOR THE RELEASE OF CONFIDENTIAL ALCOHOL OR DRUG TREATMENT 
AND [TB] [STD] [HIV/AIDS] INFORMATION TO COMPLY WITH DISEASE REPORTING 

REQUIREMENTS 

I,_authorize 

(Name of Patient) 

The ABC Substance Abuse Program 
(Name or general designation of program making disclosure) 

to disclose to the fState and/or locall Department of Health officials authorized to require and 

(Name of person or organization to which disclosure is to be made) 

receive mandated [HIV/AIDS/STD/TB] reports 

the following infonnation: (Nature of the information as limited as possible) 

(1) information that State law requires to be reported about my diagnosis and treatment for — 
[initial any which apply] 

H IV infection 
_AIDS 

_STD (sexually transmitted disease) 

_TB (tuberculosis). 

(2) my name and other personal identifying information, if required to be reported by State law; 
and 

(3) information about my status as a patient in alcohol or drug treatment, if required to be 
reported by State law. 

The purpose of the disclosure authorized herein is to: allow my alcohol or drug treatment program 


(Purpose of disclosure as specific as possible) 











(named above) to comply with State law(s) requiring the reporting of cases of 

[HIV/AIDS/S TD/TB1 


I understand that my records are protected under the federal regulations governing 
Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2, and cannot be 
disclosed without my written consent unless otherwise provided for in the regulations. I also 
understand that HIV-related information about me, STD-related information about me, and TB- 
related information about me is protected by State law and cannot be disclosed unless the 
disclosure is authorized by State law. I also understand that I may revoke this consent at any time 
except to the extent that action has been taken in reliance on it, and that in any event this consent 
expires automatically as follows: 


(Specification of the date, event, or condition upon which this consent expires) 


Dated: 


Signature of patient 


Sample Form #4 

CONSENT FOR THE RELEASE OF CONFIDENTIAL INFORMATION ABOUT ALCOHOL 
OR DRUG TREATMENT AND [TB] [STD] [AND/OR] [HIV/AIDS] CARE 

I [name and address of patient], authorize— 

(1) the following alcohol or drug treatment program(s): [name and address of each treatment 
program authorized to make and receive disclosures], 

AND 


(2) the following health care provider(s): [name and addresses of each [TB] [STD] [and/or] 
[HIV/AIDS] care provider authorized to make and receive disclosures], 

AND 


(3) [designate staff of the State/local Department of Health responsible for [TB] [STD] [and/or] 
[HIV/AIDS] prevention, control and care; specify appropriate name and address]— 










to communicate with and disclose to one another the following information: 

[initial each category that applies]* 

* _(1) Alcohol or drug treatment : infonnation about my participation and attendance in the 

alcohol or drug treatment program(s) named above that is needed to enable the persons and 
agencies listed above to provide, coordinate and monitor my treatment for [TB] [STD] [and/or] 
[HIV/AIDS]. 

* _(2) Tuberculosis (TB) : infonnation about my diagnosis and treatment for TB that is 

needed to enable the persons and agencies listed above to provide, coordinate and monitor my 
treatment for {TB] [STD] [and/or] [HIV/AIDS]. 

* _(3) Sexually transmitted disease(s) (STD) : information about my diagnosis and treatment 

for any STD that is needed in order to enable the persons named above to provide, coordinate 
and monitor my treatment for the [TB] [STD] [and/or] [HIV/AIDS]. 

* _(4) HIV/AIDS : information about my HIV status (including HIV test results and 

information about my diagnosis and treatment for HIV-related conditions, including AIDS) that 
is needed to enable the persons and agencies listed above to provide, coordinate and monitor my 
treatment for [TB] [STD] [and/or] [HIV/AIDS]. 

The purpose of these disclosures is to (1) enable the persons and agencies listed above to 
provide, coordinate and monitor the treatment I receive for [TB] [STD] [and/or] [HIV/AIDS]; 
and (2) discuss with me any [sexual/needle sharing] partners or contacts and/or family members 
who might be infected [with [TB] [STD] [HIV] and need treatment. 

I understand that my alcohol and drug treatment records are protected under the federal 
regulations governing Confidentiality of Alcohol and Drug Abuse Patient Records, 42 C.F.R. 
Part 2, and cannot be disclosed without my written consent unless otherwise provided for in the 
regulations. I also understand that HIV-related information about me, STD-related information 
about me, and TB-related infonnation about me is protected by State law, and cannot be 
disclosed except as authorized by State law. 

I understand that I may revoke this consent at any time except to the extent that action has 
already been taken in reliance on it, and that in any event this consent expires automatically as 
follows: 


[Specify the date, event or condition upon which this consent expires. This could be one of the 
following: 

(1) The date on which my treatment for [TB] [the STD] is completed. 

(2) A specific date (such as six months or one year) after the consent form is signed.] 



Dated: 


Signature of patient 


Sample Form #5 

QUALIFIED SERVICE ORGANIZATION AGREEMENT ON COORDINATION OF [HIV/STD/TB] CARE (AOD 
TREATMENT PROGRAM & [HIV/STD/TB] HEALTH CARE PROVIDER) 

[Name of health care facility providing [HIV/AIDS/STD/TB] care to Program patients] ("the 
[HIV/AIDS/STD/TB] Care Provider") and the [name of alcohol or drug treatment program] ("the 
Program") hereby enter into a qualified service organization agreement, whereby the 
[HIV/AIDS/STD/TB] Care Provider agrees to [provide, coordinate and/or monitor] the treatment 
and/or related services for [HIV/AIDS/STD/TB] being provided to patients of the Program who 
are diagnosed, treated and/or provided related services for [HIV/AIDS/STD/TB] by the 
[HIV/AIDS/STD/TB] Care Provider. 

Furthermore, the [HIV/AIDS/STD/TB] Care Provider: 

(1) acknowledges that in receiving, storing, processing or otherwise dealing with any information 
from the Program about the patients in the Program, it is fully bound by the provisions of the 
federal regulations governing Confidentiality of Alcohol and Drug Abuse Patient Records, 42 
C.F.R. Part 2; and 

(2) undertakes to resist injudicial proceedings any effort to obtain access to information 
pertaining to patients otherwise than as expressly provided for in the federal confidentiality 
regulations, 42 C.F.R. Part 2. 

Executed this_day of_, 199_. 


President AOD Program Director 

[Name of [HIV/AIDS/STD/TB Care Provider] [Name of Program] 


[address] 


[address] 










Sample Form #6 

QUALIFIED SERVICE ORGANIZATION AGREEMENT ON REPORTING OF [HIV/AIDS/STD/TB] AND 
COORDINATION OF [HIV/AIDS/STD/TB] CARE (AOD TREATMENT PROGRAM & HEALTH DEPARTMENT 

[HIV/STD/TB] STAFF) 

[Name of relevant Health Department [HIV/AIDS/STD/TB] unit and staff] ("the Health 
Department [HIV/AIDS/STD/TB] Unit") and the [name of alcohol or drug treatment program] 
("the Program") hereby enter into a qualified service organization agreement, whereby the Health 
Department [HIV/AIDS/STD/TB] Unit agrees to [provide, coordinate and/or monitor] the 
treatment and/or related services for [HIV/AIDS/STD/TB] being provided to patients of the 
Program who are diagnosed and reported as having [HIV/AIDS/STD/TB] and are provided 
[HIV/AIDS/STD/TB]-related services by the Health Department [HIV/AIDS/STD/TB] Unit. 

Furthermore, the Health Department [HIV/AIDS/STD/TB] Unit: 

(1) acknowledges that in receiving, storing, processing or otherwise dealing with any information 
from the Program about the patients in the Program, it is fully bound by the provisions of the 
federal regulations governing Confidentiality of Alcohol and Drug Abuse Patient Records, 42 
C.F.R. Part 2; and 

(2) undertakes to resist injudicial proceedings any effort to obtain access to information 
pertaining to patients otherwise than as expressly provided for in the federal confidentiality 
regulations, 42 C.F.R. Part 2. 

Executed this_day of_, 199_. 


Director AOD Program Director 

[Name of Health Department [Name of Program] 
HIVAIDS/STD/TB Unit] [address] 


[address] 






Appendix B of TAP 13: Confidentiality of Patient Records of Alcohol and Other Drug Treatment 


Appendix B—Opinion Letters 


September 25, 1990 

Richard Riseberg, Esq. 

General Counsel 

Office of the General Counsel 

Alcohol, Drug Abuse, and Mental Health Administration 
Room 4A 53 Parklawn 
5600 Fishers Lane 
Rockville, MD 20857 

Dear Mr. Riseberg: 

We are writing to offer our comments on two opinion letters issued in the past two years about 
disclosure of HIV-related information to state health departments under 42 C.F.R., Part 2. 
(Opinion letter by the Legal Advisor to the Alcohol, Drug Abuse, and Mental Health 
Administration to the Oklahoma State Department of Health (September 2, 1988) and Opinion 
letter by Acting General Counsel to the Department of Health and Human Services (Office of the 
Secretary) to the New York State Department of Health (May 17, 1989).) 

These two letters suggest a variety of ways in which HIV-related information contained in 
alcohol or drug abuse patient records protected by 42 U.S.C. § 290 dd-3 and § 290 ee-3 and 42 
C.F.R. Part 2 can be disclosed to state health departments pursuant to mandatory reporting 
requirements. We think that some of the advice offered in the letters is excellent. For example, 
we agree that obtaining patient consent is the best way to report such information while abiding 
by the federal law and regulations; and we agree that reports can be made by some programs by 
deleting alcohol or drug abuse information from the report. However, a number of suggestions 
the letters make disturb us profoundly. 

1. Use of the "audit or evaluation" exception of 42 C.F.R. § 2.53 

Both letters suggest that reports of HIV information may be made by a drug or alcohol program 
to the state health department pursuant to 42 C.F.R. § 2.53, the "audit or evaluation" exception of 
the regulations. The letters approve the use of § 2.53 whether the purpose of the state's reporting 
law is research or whether it also includes measures to control the spread of infection, such as 
contact tracing. The letters state that HIV reports made for the purposes of audit or evaluation 
could be used for contact tracing purposes if the identity of the infected individual remains 
anonymous. The letters also state that the health department can contact the patient to discuss his 




or her HIV status, and presumably, sexual and needle contacts. In other words, the public health 
authority can use the information disclosed by the programs to contact the HIV-infected patient 
directly to offer counseling and contact notification services and then approach those contacts, 
provided that the patient's name is not revealed to the contacts. 

We believe that using § 2.53 to report HIV data to public health authorities distorts the meaning 
and purpose of that section. 1 

Section 2.53 is designed to permit financial and programmatic evaluation of programs' 
functioning. The section contemplates an outside agency such as an accounting firm or a state 
regulatory agency entering the program's premises and examining and/or copying its books and 
records for the purposes of determining how the program is functioning financially or otherwise. 
Reporting the HIV status of patients to public health authorities pursuant to a mandatory 
reporting law serves no audit or evaluation function. The purpose of reporting patients' HIV 
status is clearly not to determine how the program is functioning but to permit the public health 
authorities to use patient-identifying information gained by the program for other purposes. 

Moreover, the public health department's use of patient-identifying information to perform 
contact tracing would likely violate subsection (d) of § 2.53, which states that "patient 
identifying information disclosed under [§ 2.53] may be disclosed only back to the program from 
which it was obtained and used only to carry out an audit or evaluation purpose .... " (emphasis 
added). Since contact tracing is not an audit or evaluation and does not serve such a purpose, § 
2.53(d) appears to prohibit the use of information about a patient to perform contact tracing 
functions, even when the name of the patient is not disclosed to his or her contact. 

2. Use of patient consent when the reporting may lead to civil or criminal sanctions 

The May 17, 1989 letter from the Acting General Counsel to the New York State Health 
Department notes that it would clearly be improper to use either § 2.52 or § 2.53 to make reports 
to public health officials "if the purpose of the initial report... is to investigate an alcohol or drug 
abuse patient for purposes of civil or criminal sanctions...." However, the letter then suggests that 
a program making an initial report to investigate a patient in order to punish that patient might 
make the report with patient consent under § 2.31. In fact, 42 U.S.C. §§ 290 dd-3(c) and ee-3(c) 
make clear that only a court order—not written consent—can authorize use of records for 
criminal investigations. That prohibition is carried over into the regulations at 42 C.F.R. § 
2.12(d)(1). 

We thought we would share with you another solution to the problem of complying with a 
mandatory reporting law that has occurred to us: using a "qualified service organization 
agreement" to make such mandated reports. This might be especially useful for programs that are 
not part of a general medical or mental health facility and are therefore barred in a practical sense 
from making a report by deleting alcohol or drug information. Such a "free-standing" program 
could enter into a QSOA with a laboratory or medical care provider that conducts HIV testing or 
other diagnostic services for the program. As part of its service the QSO could report the HIV 
information to the public health department and delete the alcohol and drug information from the 
report. We recognize that this solution would not be available in some states (New York is 



among them) that have strict laws restricting disclosure of HIV-related information. 

We would be pleased to discuss the issues this letter raises with you, at your convenience. 
Sincerely, 

Margaret K. Brooks 
President/Director 
Legal Action Center 
153 Waverly Place 
New York, NY 10014 


1 However, we believe that if the purpose of the state's reporting law is solely to collect research 
data about the existence, incidence and impact of HIV/AIDS, alcohol and drug programs can 
comply if the procedural requirements of § 2.52 are met, i.e., (1) if the public health authority is 
qualified to conduct the research (which it probably is), (2) if it has a research protocol to protect 
patient-identifying information and if a group of three or more individuals independent of the 
research project has reviewed the protocol and found it adequate, and (3) if the public health 
authority agrees not to disclose patient-identifying in formation except back to the program and 
not to identify any individual patient in any report or otherwise disclose patient identities. 


Opinion Letters 


May 17, 1989 

Peter J. Millock 

General Counsel 

Department of Health 

State of New York 

Corning Tower, Empire State Plaza 

Albany, New York 12237 

Dear Mr. Millock: 

We are responding to your letter of April 21 seeking our advice on how the Federal 
confidentiality regulations on alcohol and drug abuse patient records, 42 C.F.R. Part 2, affect the 
reporting of communicable diseases under New York law. In our opinion, such disclosures may 
be made by deletion of all alcohol or drug abuse information from the report consistent with 42 
C.F.R. § 2.13(c)(1), with written patient consent under 42 C.F.R. § 2.31-2.33, or as disclosure 






for purposes of research, audit, or evaluation under 42 C.F.R. § 2.52-2.53. In addition, in 
selected cases, reports may be made for purposes of treating a bona fide medical emergency 
under section 2.51. Finally, where a civil or criminal investigation of a particular individual is 
envisioned, it may be necessary to obtain an appropriate court order under section 2.64 or 2.65 of 
the regulations. 

As we understand it, New York law requires that physicians and institutions report cases of 
communicable disease to the local health officer, who in turn is required to report the 
information to the State Department of Health. Your letter states that the purpose of such 
reporting is to enable State and local health officials to "investigate cases of communicable 
disease and take whatever action is necessary and appropriate to deter the spread of a 
communicable disease." In this regard, you indicate that in at least two cases alcohol abuse 
facilities have refused to cooperate with "communicable disease investigations" based on the 
Federal confidentiality regulations. Because of your concern that the Federal law impedes the 
implementation of State reporting requirements, you have sought our advice on the matter. 

We have recently responded to a similar inquiry from the State of Oklahoma on HIV reporting 
and are enclosing a copy of our reply for your review. We advised in that situation that HIV 
reports may be made to Oklahoma public health officials as audit or evaluation disclosures under 
42 C.F.R. § 2.53 if the purpose of such reports was to increase the knowledge of the incidence 
and prevalence of HIV and for health planning purposes. We also suggested, and now conclude, 
that under appropriate circumstances such reports could also be made for purposes of research 
under section 2.52. Finally, we advised that such reports could be made with the patient's written 
consent under sections 2.31 and 2.33 of the regulations. In this regard, we enclosed an opinion to 
Beth Israel Medical Center in New York City which discusses making venereal disease reports 
under State law either with written patient consent or by deletion of alcohol or drug abuse 
identifying information from the report. See 42 C.F.R. § 2.12(a)(l)(I) and (e)(3) and 2.13(c)(1). 

In the Oklahoma opinion, we concluded that HIV reports made for purposes of audit or 
evaluation could be redisclosed back to the alcohol or drug abuse program from which the 
information was obtained and could otherwise be used for contact tracing purposes if the identity 
of the infected individual remained anonymous. However, we should emphasize that both the 
authorizing legislation and the regulations would otherwise generally prohibit the redisclosure of 
alcohol or drug abuse patient identities where the original disclosure was made for purposes of 
research, audit, or evaluation. 42 U.S.C. § 290dd-3; 42 U.S.C. § 290ee-3; 42 C.F.R. §§ 
2.52(a)(2)(h) and (b) and 2.53(d). 

Thus, it is unclear to us whether the type of "communicable disease investigations" to which you 
refer in your letter could be carried out under section 2.52 or 2.53 of the regulations. In 
particular, it is our view that if the purpose of the initial report to public health officials is to 
investigate an alcohol or drug abuse patient for purposes of civil or criminal sanctions the report 
could not be made as a disclosure for purposes of research, audit, or evaluation. In those 
circumstances, the report would need to be authorized with written patient consent or a court 
order under 42 C.F.R. § 2.64 or 2.65. With respect to section 2.65, we note, however, that it only 
authorizes disclosures for purposes of criminally investigating or prosecuting an alcohol or drug 



abuse patient in cases of "extremely serious" crimes. 42 C.F.R. § 2.65(d)(1). 

In your letter, you have particularly sought our advice on whether the authority in section 2.51 
for disclosing alcohol or drug abuse patient records in cases of a bona fide medical emergency 
would permit communicable disease reports. We have advised under prior regulations that a 
positive venereal disease test did not constitute a bona fide medical emergency under the 
authorizing legislation and regulations because the need for medical treatment of the infected 
individual was not sufficiently immediate to consider it an emergency and, thereby, to justify 
bypassing the nonnal procedures for obtaining a written consent or a court order. However, as 
the revised regulations provide that the medical emergency which justifies the disclosure could 
be a threat to the health of "any individual" and not just the patient (42 C.F.R. § 2.51(a); 48 Fed. 
Reg. 38767, August 25, 1983) and in recognition of the varying seriousness of different diseases, 
we now conclude that the incidence of venereal and other communicable diseases should be 
assessed on an individual basis to determine whether they constitute a bona fide medical 
emergency for which a disclosure could be made under section 2.51. 

To justify such a disclosure, it is necessary to detennine that the information would be disclosed 
to "medical personnel" for the purpose of treating a condition which poses an "immediate threat" 
to the health of any individual and which requires "immediate medical intervention." 42 C.F.R. § 
2.51(a). Furthennore, the alcohol or drug abuse program making the disclosure is required to 
document the circumstances surrounding the disclosure, including the medical personnel to 
whom the disclosure was made and the nature of the emergency. 42 C.F.R. § 2.51(c). 

Because of the nature of these determinations and the documentation required, we believe that a 
medical emergency disclosure would normally have to be made on a case-by-case basis. Thus, 
we do not find that it constitutes a general authority for making communicable disease reports. In 
addition, while the authorizing legislation and regulations do not contain a prohibition on 
redisclosure as is done for research, audit, and evaluation disclosures (42 U.S.C. § 290dd- 
3(b)(2)(A); 42 U.S.C. § 290ee-3(b)(2)(A); 42 C.F.R. § 2.51), they do prohibit use of the 
information to criminally investigate or prosecute the alcohol or drug abuse patient absent the 
appropriate court order. 42 U.S.C. § 290dd-3(c); 42 U.S.C. § 290ee-3(c); 42 C.F.R. § 2.12(d)(1). 
Thus, once again we are unsure whether this authority would permit the type of "communicable 
disease investigations" you envision. 

In summary, subject to the constraints discussed above, we conclude that communicable disease 
reports may be made by alcohol and drug abuse treatment programs under New York law by 
deletion of alcohol or drug abuse information from the report, with written patient consent, for 
purposes of research, audit, or evaluation, to medical personnel in cases of a bona fide medical 
emergency, or pursuant to an authorizing court order. If you have any further questions, you may 
wish to discuss them directly with Chris Pascal of my staff who advises the Department on the 
Federal confidentiality laws. If you wish to contact him, he may be reached at 301-443-1212. 

Sincerely, 

Susan K. Zagame 
Acting General Counsel 



Office of the Secretary 

Department of Health and Human Services 

Washington, D.C. 20201 

Enclosures 

bee: Dr. Pickens 
Sandy Garcia 
Barbara McGarey 
Verla Neslund 
Dr. Jones, CDC 
Aaron Handler, IHS 
Robert Allen, Ph.D., VA 


Opinion Letters 


National Institute on Drug Abuse, Opinion 78 3, February 1, 1978 (Legal Opinions on the 
Confidentiality of Alcohol and Drug Abuse Patient Records (1975 1978), at p. 13 (1980)) 

REPORTING OF POSITIVE FINDINGS OF VENEREAL DISEASE IN HOSPITAL 
PATIENTS WITHOUT IDENTIFYING THEM AS RECIPIENTS OF METHADONE 
MAINTENANCE TREATMENT (2.1 l(p)(3); 2.110')) 

To Mr. Karten, Beth Israel Medical Center, New York, NY 

You request an opinion on whether, consistent with the "Confidentiality of Alcohol and Drug 
Abuse Patient Records" regulations, 42 CFR Part 2, Beth Israel Medical Center may report to 
local health authorities positive venereal disease results of hospital patients enrolled in a 
Methadone Maintenance Treatment Program (MMTP), if those patients are not identified in any 
way as MMTP patients. 

It is our opinion that the confidentiality regulations permit Beth Israel Medical Center (BIMC) to 
report, without patient consent, to local health authorities positive venereal disease results of 
BIMC patients who are enrolled in a Methadone Maintenance Treatment Program, if the patients 
are not identified in any way to the health authorities as MMTP patients. 

BIMC is a voluntary hospital which operates a Methadone Maintenance Treatment Program. 
Under section 11.03 of New York City's Health Code, the hospital is required to report all 
patients with positive findings of venereal disease to local health authorities. Due to the possible 
conflict between the confidentiality regulations which restrict disclosure of drug abuse patient 
records and local health laws which require disclosure to health authorities of the identity of all 





patients with positive venereal disease results, the Division of Methadone Monitoring, Food and 
Drug Administration, has recommended that as part of their intake procedure drug abuse 
treatment programs, including MMTP, routinely obtain patient consent to release identifying 
information in cases of positive findings of venereal disease. 

You have indicated dissatisfaction with this method of releasing positive venereal disease results 
of MMTP patients, expressing concern that seeking consent at intake for disclosure of patient 
identifying information under such circumstances will be perceived as coercive by prospective 
patients, and thus render the consent involuntary. As an alternative, Beth Israel Medical Center 
has proposed to report the positive venereal disease results of its MMTP patients by identifying 
them as BIMC patients without indicating that they are MMTP patients. In you inquiry, you have 
asked us whether this proposed method of reporting is allowed under the confidentiality 
regulations. 

It is our opinion that BIMC's proposed method of reporting positive venereal disease results is 
consistent with the confidentiality regulations. 1 42 CFR § 2.13(a) states that "[rjecords to which 
this part applies shall be confidential and may be disclosed only as authorized by this part...." 42 
CFR § 2.11 (p) states: 

"The following types of communications do not constitute disclosures of records: 


"(3) Communications of information which includes neither patient identifying infonnation nor 
identifying numbers assigned by the program to patients." 2 

Read together, these two provisions of the regulations provide that communications of 
information which include neither patient identifying information nor identifying numbers 
assigned by the program to patients are not disclosures of records subject to the restrictions of 42 
CFR Part 2. Thus, BIMC may report the positive venereal disease results of its MMTP patients 
without patient consent, if the reports do not disclose "patient identifying information" or 
"identifying numbers assigned by the program to patients." 

Section 2.11 (j) of the regulations defines "patient identifying information", in pertinent part, as 
"... information by which the identity of a patient can be determined with reasonable accuracy 
and speed either directly or by reference to other publicly available information." Furthermore, 
"patient" is defined, in pertinent part, by §2.11 (i) as "any individual... who has applied for or 
been given diagnosis or treatment for drug abuse or alcohol abuse ..." (Emphasis added.) Thus, 
we conclude that "patient identifying information" as used in 42CFR§2.1 l(p)(3) refers to 
infonnation which can be used to identify a patient, with reasonable accuracy and speed, as an 
"individual... who has applied for or been given diagnosis or treatment for drug abuse or alcohol 
abuse." Accordingly, when reporting its patients' positive venereal disease results, if BIMC does 
not identify a patient as having applied for or been given diagnosis or treatment for drug or 
alcohol abuse nor provide his or her program identifying number, it is not making a disclosure of 
a record for purposes of the regulations. 




This conclusion is consistent with 42 CFR § 2.13(f) which provides that: 

"The presence of any in-patient in a medical facility for the treatment of drug or alcohol abuse 
may be acknowledged to callers and visitors with his written consent. Without such consent, the 
presence of any in-patient or resident in a facility for the treatment of a variety of conditions may 
be acknowledged if done in such a way as not to indicate that the patient is being treated for 
drug or alcohol abuse." (Emphasis added.) 

Since Beth Israel Medical Center is a "voluntary hospital" which, we presume, treats a variety of 
conditions, it qualifies under section 2.13(f) as a facility that may report the presence of a drug or 
alcohol abuse patient in its facility without the patient's consent if this reporting is done "in such 
a way as not to indicate that the patient is being treated for drug or alcohol abuse." 

In summary, we conclude that BIMC may report, without patient consent, the positive venereal 
disease results of its MMTP patients to local health authorities, if these patients are not identified 
as MMTP patients in accord with the provisions of 42 CFR §§2.1 l(p)(3) and 2.13(f). 


*We note that we do not find anything legally incorrect in the Division of Methadone 
Monitoring's recommendation that patient consent to disclosure of positive venereal disease 
results be routinely obtained at intake. This recommendation is consistent with our prior advice. 
Letter, GH (Greene) to Young, July 18, 1977 (DF #25B). 

2 For a general discussion of 42 CFR § 2.11 (p)(3), see, letter, GFI (Edelman) to Ichord, May 17, 
1977 (DF #25B). 


Opinion Letters 


September 2, 1988 

John Harkess, M.D. 

Assistant State Epidemiologist 
Oklahoma State Department of Health 
P.O.Box 53551 
1000 N.E. Tenth 

Oklahoma City, Oklahoma 73152 

Re: Disclosure of HIV Records to State Health Department Under 42 C.F.R. Part 2—GH Ref. 
#88-1776 (DF#92, #25B) 

Dear Dr. Harkess: 






We are responding to your letter of July 12, 1988, and our subsequent phone conservation in 
which you requested legal advice on the disclosure of HIV information from drug abuse 
treatment records subject to 42C.F.R.Part 2 to the Oklahoma State Department of Health. This 
disclosure is now required in Oklahoma under a change in State law which makes HIV infection 
a reportable disease. Okla. Stat. tit. 63, § 1-503 (1981) (an emergency rule was adopted Jan. 20, 
1988, by the Oklahoma State Board of Health adding HIV to the list of reportable diseases). 

As we understand it, the procedure for reporting HIV infections to the health department is as 
follows. The infected person's name and birthdate is reported, although no address is included. 
The health department uses this information to increase its knowledge of the incidence and 
prevalence of the disease and for health planning purposes. It also will use this information 
internally to eliminate double-counting of HIV cases (where reports on the same person are 
received from more than one source) and to contact the infected person to offer services, such as 
HIV counseling and assistance with contact notification. Although HIV reports may be made in 
other instances as well, most reports involving drug abusers are expected as a result of a State 
health department initiative which offers drug abuse patients HIV testing with informed consent 
and pre- and post-test counseling. Your legal questions concern how the Federal confidentiality 
regulations for drug abuse treatment programs, 42C.F.R. Part 2, affect compliance with 
Oklahoma’s HIV reporting requirement and the health department's use of this in formation once 
received. 

We have previously advised that identifiable HIV records may be disclosed from drug abuse 
treatment programs to public health authorities without patient consent to the extent that the 
infonnation is needed to research the causation of AIDS, to conduct epidemiological studies or 
health program planning, or to evaluate the incidence and treatment of the disease. 1 Although the 
regulatory provisions on which this prior advice was based have changed, we believe that HIV 
reports may be made by drug abuse treatment programs to the Oklahoma health department 
without patient consent under 42 C.F.R. 2.53 as a disclosure for the purposes of audit or 
evaluation. Although section 2.52 which authorizes disclosures for research activities could also 
be used for making HIV reports to the health department, it requires the researcher to obtain an 
independent review of the research protocol for purposes of protecting the research subjects 
before any drug abuse records may be disclosed. 42 C.F.R. 2.52(a)(3) (as amended by 52 F.R. 
41997, Nov. 2, 1987). 3 Thus, it might be unsuitable for the type of mandatory HIV reporting 
envisioned here. 4 In any event, reliance on section 2.52 does not appear necessary as disclosures 
to the health department could be made under section 2.53. Although 2.53 authorizes the initial 
disclosure of HIV information to the health department, the health department may not identify 
any individual patient in any report of its audit or evaluation activities or otherwise redisclose 
information except back to the program from which it was obtained. 42 C.F.R. 2.53(d); 42 
U.S.C. § 290ee-3(b)(2)(B). 5 

This limited authority to make redisclosures would permit the State health authority to contact 
the drug abuse treatment program that made the HIV report to offer counseling and contact 
notification services to the HIV infected individual. It would also permit the public health 
authority to notify the sexual and needle contacts of the HIV individual because, as we 
understand it, such notification keeps the name of the infected person anonymous, thus 
exempting this communication of information from the meaning of disclosure under the 



regulations. 42 C.F.R. 2.11 ("disclosure"); 42 C.F.R. 2.12(a)(l)(I). 6 However, there is no explicit 
authorization in the regulations for contacting the HIV infected individual directly if the 
individual is no longer at the drug abuse program. We previously advised under the prior 
regulations that we did not believe the confidentiality protections were intended to restrict 
disclosures to the patient of information in his or her records of which the patient was already 
aware. 7 We find that this position continues to be sound under the revised regulations and, 
accordingly, conclude that the State health authority may contact the HIV infected individual 
directly to offer counseling and contact notification services. However, in doing so, the authority 
must ensure that it does not disclose infonnation that would identify the individual as a drug 
abuse patient to others. 

In addition to the nonconsensual disclosures which may be made for purposes of research, audit, 
or evaluation, HIV reports may be made to public health authorities with written patient consent. 
The use of written patient consent has a number of advantages, including placing the patient on 
notice of the existence of the State HIV reporting law and ensuring that the State health 
department may make all disclosures necessary to fulfill their contact notification 
responsibilities. 

In obtaining the patient’s consent, the confidentiality regulations require that a special consent 
form must be used and that any needed redisclosures must be expressly permitted. 42 C.F.R. 2.31 
and 2.32. Because HIV testing on drug abusers in Oklahoma will largely be performed with 
patient consent at drug abuse treatment programs, it may be convenient to obtain the patient's 
written consent to disclosure at the same time consent to the HIV test is obtained. Since the 
confidentiality regulations themselves and Oklahoma law provide for confidentiality of the HIV 
report, those individuals who wish to be tested would presumably be willing to consent to 
disclosure of the HIV information to the State health authority. Nevertheless, in those cases 
where consent was not obtained, the HIV information could be reported for purposes of research, 
audit, or evaluation as previously discussed. 

In summary, we believe that the reports of HIV infection required under Oklahoma law may be 
made in compliance with the Federal confidentiality laws for drug abuse treatment records, 42 
U.S.C. § 290ee-3 and 42C.F.R. Part 2, either with written patient consent or, without such 
consent, as a disclosure for purposes of research, audit, or evaluation. 

We hope this information has been helpful. Please let me know if you have any further questions. 
Sincerely, 

Chris B. Pascal, Legal Advisor 

Alcohol, Drug Abuse, and Mental Health Administration 

Public Health Division 

Department of Health and Human Services 

Room 4A-53 Parklawn Bldg. 

5600 Fishers Lane 
Rockville, MD 20857 



bcc: Dr. Pickens Gene Matthews 
Verla Neslund Sandy Garcia 
Barbara McGarey Bill Quinlin 
Dr. Allen, VA Dick Riseberg 
John Holliday 


'Memorandum, GH (Pascal) to NIDA (Gardner), Nov. 3, 1983 (DF #25B); See also, C. Pascal, 
"Selected Legal Issues About AIDS for Drug Abuse Treatment Programs," Journal of 
Psychoactive Drugs, Vol. 19, P. 2, Jan.-Mar. 1987. 

9 

Although revised section 2.53 refers to an evaluation or audit activity encompassing a "review 
of records on program premises" (which is not envisioned here since the program will transmit 
the information to the State), we do not believe this is intended as a limitation on the type of 
audit and evaluation activities which could be conducted but rather as a description of perhaps its 
most common form. In this regard, we do not find that there was any intention during the 
revision of the regulations to restrict disclosures for audit or evaluation activities to an on-site 
review of records and note that the definition of "program evaluation" in the prior regulations 
was much broader in scope than the evaluation of an individual alcohol or drug abuse program. 
See 52F.R. 21800, 21801, June 9, 1987; 42 C.F.R. 2.11(f)(2) and (g)(2) (1986) (prior 
regulations). Accordingly, we conclude that an HIV report to the Oklahoma State Health 
Department may be made as a nonconsensual disclosure for purposes of audit or evaluation 
under 42 C.F.R. 2.53 and 42 U.S.C. § 290ee-3(b)(2)(B). 

It is interesting to note that the authority of the Veterans Administration for protection of alcohol 
and drug abuse patient records (which is modeled after the Department of Health and Human 
Services authority discussed here) was recently amended to add HIV records to the 
confidentiality protections and to give explicit authority for disclosing the HIV records to State 
or local public health authorities without consent. 38 U.S.C. 4132(b)(2)(C), as amended by 
section 121 of Pub. L. 100-322, the "Veterans' Benefits and Services Act of 1988," enacted May 
20, 1988. 

We have doubts that the provisions of section 2.52 requiring a research protocol and its 
independent review are intended to apply to the type of non-experimental research contemplated 
here, i.e., tracking the causation and incidence of disease. In this regard, the prior regulations did 
not restrict the meaning of "scientific research" in any way and there is no indication that the 
Department intended to change this position in the revised regulations. 42 C.F.R. 2.52(a), 2.52- 
l(n), and 2.53(c)(1986); 48F.R.38765,38766, Aug. 25, 1983; 52 F.R. 21800, 21801, June 9, 

1987. This suggests that the conduct of research which does not include a formal research 
protocol would not be barred by section 2.52 nor would it be subject to the protocol review 
requirements. However, we need not formally resolve this issue because we believe that the type 
of reporting required by the State health department falls within the scope of disclosures for 
purposes of audit or evaluation as discussed above. 

4 We note, however, that, even assuming the research protocol provisions of section 2.52 apply, 




certain Federally sponsored FIIV testing, such as that performed under the national 
seroprevalence survey, has received Institutional Review Board approval and, thus, would 
comply with these provisions. 

5 Section 2.53(a) requires the person performing the audit or evaluation activity to agree in 
writing to abide by the prohibitions on redisclosure. We believe the State health department may 
comply with this provision by simply adopting a written policy to this effect and notifying the 
pertinent drug abuse providers of its existence. 

6 We note that the Veterans Administration statute discussed in Note 2 also provides for 
nonconsensual notification of a positive finding of HIV to the infected person’s spouse or sexual 
partner. 38 U.S.C. 4132(f). This is consistent with recommendation 9-36 of the Report of the 
Presidential Commission on the Human Immuno-deficiency Virus, p. 129 (June 1988). 

7 In Opinion 77-14, we advised that "neither the confidentiality statutes, 21 U.S.C. § 1175 and 42 
U.S.C. 4582, nor the regulations, are intended to restrict the communication to a patient of 
limited information, necessary for purposes of bill collection, which he knows by reason of his 
participation in the program...." We believe this same analysis would apply to a disclosure to the 
patient of his HIV status by the State health department in those cases in which the patient has 
already received the information from the program. 



